“The risk is being managed.” “The control is effective.” “We are compliant.” These statements appear routinely in board papers. But what exactly supports them? Who checked, what did they examine, and how independently?
For non-executive directors, the challenge is not to become auditors or operational managers. It is to establish a reasonable, proportionate basis for confidence – and to recognise when further inquiry is necessary. An assurance map can turn a collection of reassuring statements into an intelligible account of evidence, uncertainty and accountability.
Assurance is evidence, not reassurance
Management reporting tells the board what those running the organisation believe is happening. Assurance is the structured evaluation of information against defined criteria, supported by evidence. Both matter. A business manager may have detailed knowledge of operations, while an independent reviewer can provide a more objective assessment of design, operation and weaknesses. Independence, however, is not synonymous with competence, and an external consultant is not necessarily independent of management merely because they are external.
The board should distinguish control design (would the control address the risk if operated as intended?), implementation (has it actually been put in place?) and operating effectiveness (did it operate consistently throughout the relevant period?). A policy, a dashboard, a certificate or a management sign-off, standing alone, rarely answers all three questions.
Three lines – not four lines of defence
The Institute of Internal Auditors updated its framework in 2020 from “Three Lines of Defence” to the “Three Lines Model”. Its emphasis extends beyond protecting against losses to governance, collaboration and creating and protecting value. It remains useful, provided it is applied flexibly rather than as an organisational chart or compliance ritual.
First line – operational managers and personnel own and manage risks, run controls and maintain records. Evidence includes reconciliations, access logs, incident registers, supervisory checks and actual performance data.
Second line – risk, compliance and specialist functions provide expertise, frameworks, monitoring and challenge. Evidence includes compliance testing, thematic reviews, risk-limit breaches, control assessments and documented follow-up. They remain part of management, notwithstanding safeguards for objectivity.
Third line – internal audit supplies independent and objective assurance and advice to the governing body on governance, risk management and controls. Evidence includes scoped engagement plans, testing workpapers, findings and independently validated remediation.
External assurance – statutory auditors, cybersecurity specialists, certifiers and other external reviewers may contribute additional evidence. They are not automatically a “fourth line” in the IIA model; the value of their work depends on who commissioned it, independence, competence, criteria, scope and intended users.
A regulatory examination is another valuable signal, but it is not an all-purpose certification of sound governance. Regulators inspect selected issues for supervisory or enforcement purposes; boards should not treat the absence of regulatory criticism as affirmative assurance.
What does a good assurance map actually show?
Begin with the few risks and obligations whose failure could materially harm customers, employees, beneficiaries, finances, licence to operate or strategic objectives. For each, identify the accountable executive, key preventive and detective controls, inherent and residual exposure, testing coverage and results, and escalation path. Show who performed the assessment, the period covered, whether the evidence is current and sufficiently independent, any material qualifications, and the status of corrective action.
A board-level map should make gaps and duplication immediately visible. A dense spreadsheet can sit behind it. The board needs a concise view of consequential risks, the strength and limitations of available assurance, material exceptions and decisions required.
Risk / key control
Assurance and evidence
Gap / response
Escalation
Cyber: privileged access and patching
IT logs and monthly first-line review; second-line testing; periodic specialist security review
Specialist testing covers external perimeter but not cloud administration; commission targeted review
Critical exploited vulnerability or material breach → incident lead, executive, chair/board and regulator as legally required
Operational resilience: recovery of critical service
BCP exercise results, restore tests, service-provider evidence; internal audit periodic review
Restore test failed under severe-but-plausible scenario; interim workaround and retest dates
Tolerance breach → crisis team, executives, board; regulatory notice where applicable
AML/CTF: customer due diligence and monitoring
Case-quality samples, alerts and exceptions; compliance review; risk-based independent assurance
Repeated overdue reviews and weak closure evidence; investigate root cause
Material legal breach or systemic weakness → accountable executive and board; assess reportability
Illustrative only: testing cadence, thresholds and regulatory requirements must be adapted to the entity and sector. A map must not substitute for the underlying working papers or risk register.
How strong is the evidence?
Inquiry, observation, document or system-record inspection, recalculation and reperformance can each support control testing, but none is uniformly “strongest” in every situation. Evidence quality depends on the control, the population, the reliability of source data and whether the test addresses the relevant assertion. Sample sizes cannot be prescribed by a generic table: they depend on frequency, inherent risk, expected deviations, required confidence and the testing objective. A single successful test of an automated control does not establish year-round effectiveness unless its configuration, access, change-management environment and dependencies are adequately addressed.
Boards can usefully ask for the testing method, period, population, exceptions, severity assessment and scope exclusions – without reading the individual workpapers. Continuous monitoring, process mining and carefully governed AI may expand coverage, but automated exceptions and model outputs still require validation, secure data and human judgment.
When is independent assurance worth the cost?
Independence is a means to better evidence, not a trophy. Experienced internal specialists may provide highly useful assurance, particularly where resources are limited. Commissioning an external review is more persuasive when consequences are severe, expertise is scarce, management has a conflict, the issue is novel, or earlier findings have not been resolved. Illustrative examples include red-team testing, clinical safety assessment, major technology transformation, climate-disclosure methodologies and financial-crime control effectiveness.
Outsourcing internal audit is also legitimate: an appropriately governed outsourced or co-sourced function can provide third-line assurance. Whether internal or outsourced, its charter, functional reporting to the board, freedom from management responsibilities, quality assurance and competence matter. Modern internal audit has evolved well beyond transaction checking towards risk-based reviews of strategy execution, technology, culture, resilience and governance. The IIA’s Global Internal Audit Standards took effect in January 2025.
A statutory financial report audit has a defined purpose: reasonable assurance on whether the financial report as a whole is free of material misstatement. It is not, without a separate engagement, a positive opinion on every operational, compliance or cybersecurity control. Likewise, a certification is meaningful only within its specified standard, scope, validity period and limitations.
Attestations, culture and the right to speak frankly
Management attestations are valuable if they are built on traceable sub-certifications, evidence and explicit exceptions. Directors should ask who signed, what they reviewed, whether any reservations were overridden, and what happened to dissenting views as assurances moved up the hierarchy. A perfect “all green” report in an organisation with staff turnover, incidents, whistleblower disclosures or repeated audit findings should invite greater scrutiny, not automatic comfort.
Culture is therefore part of the assurance environment. Can people report unwelcome facts without retaliation? Are risk and internal audit leaders able to speak directly to the board or committee chair? Do commercial pressures cause exceptions to disappear? The ancient idea of parrhesia – candid speech despite personal risk – captures a modern governance requirement: the board needs reliable channels through which inconvenient truths can be heard.
Escalation mapping: what happens when assurance breaks down?
Assurance mapping describes what is known about controls. Escalation mapping specifies how people must respond when a threshold is crossed or serious doubt arises. A workable protocol defines qualitative and quantitative triggers, severity classification, accountable decision-makers, notification pathways, time expectations, recordkeeping, regulator and customer notifications where applicable, and who has authority to act urgently. A RACI chart (responsible, accountable, consulted, informed) may clarify roles, but an internal notification target is not automatically a legally binding service-level agreement.
Critically, escalation should not depend on one executive acting as the sole gatekeeper. There should be direct routes to the chair or relevant committee, supported by appropriate whistleblower, legal and crisis pathways. Mechanisms should operate outside the ordinary quarterly reporting cycle when circumstances require it. A board may delegate scrutiny to a committee, but it does not thereby relinquish its ultimate oversight responsibilities.
What does Australian law and regulation expect?
Directors’ duties, including the care-and-diligence obligation in s 180(1) of the Corporations Act 2001 (Cth), provide the foundational context. Section 189 recognises reliance on specified officers, advisers and board committees in prescribed circumstances, including good faith and independent assessment. It does not license uncritical acceptance. In ASIC v Healey [2011] FCA 717 (Centro), the Federal Court emphasised directors’ own responsibility to engage with financial statements rather than substitute the work of advisers for their judgment.
For ASX-listed entities, the operative fourth edition of the ASX Corporate Governance Principles and Recommendations includes Recommendation 7.2 on annual review of the risk framework; Recommendation 7.3 on disclosure concerning internal audit or alternative evaluation processes; and Recommendation 4.2 on the CEO/CFO declaration before financial statements are approved. These are governance recommendations subject to the ASX “if not, why not” reporting framework, not uniform statutory commands for all companies. ASX has consulted on revisions during 2026; proposals should not be treated as already operative.
For relevant APRA-regulated entities, CPS 220 includes formal board responsibilities, review and risk-management declaration arrangements. CPS 230 addresses operational control testing, incident escalation and resilience; CPS 234 addresses systematic security-control testing and functionally independent specialists. Their applicability and commencement must be checked by entity type. AFS licensees, responsible entities and registered charities operate under additional, different legislative and regulatory settings.
The Star case: a warning against both simplistic reliance and simplistic blame
In Australian Securities and Investments Commission v Bekier [2026] FCA 196, Justice Lee found breaches of s 180(1) by two former Star executives in relation to the handling and communication of serious risks, but dismissed ASIC’s case against seven non-executive directors. ASIC subsequently announced disqualifications and pecuniary penalties for Mathias Bekier and Paula Martin; ASIC also recorded that they lodged notices of appeal in July 2026. The findings must be read in their pleaded and evidentiary context, and the appeal status should be checked before publication.
The practical lesson is not that directors must independently investigate every managerial statement, nor that relying on management is invariably safe. It is that information flow, the quality of assurance, organisational incentives and sensible inquiry matter. Boards should know how significant specialist reports, regulatory concerns and control failures reach them, and whether the information presented has lost important qualifications in transmission. A successful legal defence on particular pleaded facts is not a comprehensive endorsement of every governance practice.
Six questions for a board or audit and risk committee
Which material risks are supported only by management self-assessment, and why is that proportionate?
What material control has not been tested recently, and what is the consequence if it fails?
What did the reviewer actually test – design, implementation, or operation – and over which period?
Where do assurance providers duplicate work, and where are we missing relevant expertise or evidence?
Which adverse findings, near misses, unresolved qualifications or overdue actions have been escalated, and how will closure be verified?
What information might reach the board later than it should – or not reach it at all?
A useful final test is to ask the risk leader or head of internal audit privately: “What concerns you most that is not apparent from our current reporting?” Private discussions need safeguards for confidentiality, lawful privilege and escalation, and should not become a substitute for ordinary transparent reporting.
Conclusion: confidence should be earned
Effective assurance mapping does not mean ever more audits, dashboards or certificates. It means matching credible evidence to material risks, exposing uncovered areas, avoiding wasteful duplication and ensuring warnings travel quickly to people empowered to act. A mature board is not seeking a permanently green dashboard. It is seeking a reliable account of what is working, what is uncertain and what must change.
Governance in Action Pty Ltd can assist clients with risk identification, assurance / escalation processes and mapping, comprehensive reviews of board and committee workplans, selection of assurance providers and the development and implementation of integrated assurance plans in collaboration with leading risk management professionals and relevant industry experts.
David Cantrick-Brooks FGIA FCG, Principal & Director of Governance in Action Pty Ltd, would be pleased to assist with enquiries. Please feel free to reach out via LinkedIn or via gia.net.au.
AI-assisted tools and techniques were used here to support the research, drafting and editing of this publication. Responsibility for the final content rests with David Cantrick-Brooks.
Whilst accounting and legal terms and references may be contained in this publication, it does not constitute or purport to be or represent accounting or legal advice of any kind – whatsoever. Readers should seek their own independent professional advice.
